BrewDog founder James Watt faces GDPR complaints over buyback proposal

James Watt, the BrewDog founder who sold the debt-laden “punk” brewer earlier this year, is the subject of complaints to the UK’s data privacy watchdog linked to his surprise bid to buy the company back, the Guardian has learned.

BrewDog’s brand, intellectual property, UK breweries and 11 bars were sold to the US cannabis and drinks firm Tilray in March for £33m, in a deal that rendered the shares of more than 200,000 crowdfunding investors worthless.

On Wednesday, Watt unexpectedly announced a plan to wrest back control of the beer company, with support from 43,000 of those investors, labelled “equity punks”, via a new venture called Second Best.

The audacious proposal involved Watt contacting thousands of shareholders to offer them the “exact same stake in Second Best that you once held in BrewDog, for free”.

Several sources who received an email from Watt said they did not understand how he had their contact details, giving rise to concerns about a potential breach of the general data protection regulation (GDPR) – strict rules governing how organisations can collect, store and process personal data.

Watt denied any wrongdoing. “A communication was sent to my fellow shareholders in BrewDog following legal advice, using lawfully obtained data, and in connection with their legitimate interests as shareholders,” he said. He did not explain how contact details of shareholders were obtained.

The Information Commissioner’s Office (ICO), which regulates data privacy, has been asked to investigate by several former BrewDog shareholders who received messages from Watt.

The watchdog, which has the power to impose fines or compel organisations to change their practices if it finds a GDPR breach, is now considering the complaints.

Marc Knox, a former equity punk, said he had written to Second Best about his concerns and was prepared to take a complaint to the ICO, although he had not yet done so.

“I got the email last Sunday and I kind of laughed. I wasn’t thinking about complaining but I talked to a friend, looked online and saw there were lots of people saying the same thing: ‘How has this joker got my details?’”

The Guardian understands that neither Tilray nor AlixPartners, the administrator of the remainder of BrewDog, provided any such information to the self-styled “punk” brewer.

Ravi Naik, the legal director at the data protection specialist AWO, said that while it was not clear that a breach of privacy laws had taken place, the case raised significant questions.

“I can understand why the individuals have complained to the ICO,” he said. “There seem to be questions to answer and the ICO should explain if they plan to take action on these complaints. Key questions are how the people who received the email were selected and whether the email campaign was compliant with the law.”

A spokesperson for Tilray said the company “did not acquire Equity for Punks shareholder data as part of its acquisition of the BrewDog brand and assets; that records system remains under the control of BrewDog plc (in administration).

“For the avoidance of doubt, Tilray Brands (trading as BrewDog) and its current management team have no involvement in, affiliation with, or responsibility for James Watt’s business activities, including Second Best.

“Tilray Brands did not authorise, facilitate, or participate in the communications reportedly sent to former Equity for Punks investors and did not authorise the use of any acquired data for such purposes.

“We take data privacy with the utmost seriousness and can categorically confirm that no data held by Tilray Brands has been shared with external entities or former directors. All communications with our customer base are conducted in strict compliance with GDPR.”

The ICO said it did not comment on individual cases but all complaints were considered in line with its standard process.